FW: iDEFENSE Security Advisory - GNU Radius Remote Denial of Service Vulnerability
"vendor-disclosure" <[email protected]> Mon, 2 Feb 2004 18:44:16 -0500
| Newsgroups | gmane.comp.gnu.radius.bugs |
|---|---|
| Message-ID | <[email protected]> |
We were unable to contact Sergey Poznyakoff directly with this issue and we are therefore posting it to the [email protected] mailing list. The vulnerability detailed in the attached advisory appears to have been fixed in the latest version of GNU Radius, version 1.2. As a result, we are planning to issue a public advisory on Wednesday February 4th. If anyone objects - please contact me asap. Michael Michael Sutton, CA, CISA Director, iDEFENSE Labs iDEFENSE 1875 Campus Commons Drive, Suite 210 Reston, VA 20191 703-390-1230 msutton[at]idefense.com www.idefense.com -----Original Message----- From: Michael Sutton Sent: Thursday, January 29, 2004 7:45 PM To: '[email protected]' Subject: iDEFENSE Security Advisory - GNU Radius Remote Denial of Service Vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sergey: iDEFENSE has identified a Remote Denial of Service vulnerability in GNU Radius Server. This vulnerability was submitted to iDEFENSE through our Vulnerability Contributor Program (http://www.idefense.com/poi/teams/vcp.jsp). iDEFENSE Labs has validated this vulnerability and has drafted the attached advisory. In accordance with our vendor disclosure policy (http://www.idefense.com/legal_disclosure.jsp) we would request that you acknowledge receipt of this initial notification within five business days. If you would prefer, we can post the advisory to [email protected], but chose not to initially as it appears to be a public list. We believe that this vulnerability has already been addressed in v1.2 of GNU Radius Server. Please let us know if you concur so that we can prepare a public disclosure for this issue. Regards, Michael Sutton Michael Sutton, CA, CISA Director, iDEFENSE Labs iDEFENSE 1875 Campus Commons Drive, Suite 210 Reston, VA 20191 direct: 703.480.5628 voice: 703.390.1230 fax: 703.390.9456 [email protected] www.idefense.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQBmo+F8ufGaIwaKhEQLBSwCg1XOgDZT2FwzKRfbiwLe8esnHpeIAoOIF dplmqg5hQx/FmyD/PLlb2bOM =vVn2 -----END PGP SIGNATURE----- _______________________________________________ Bug-gnu-radius mailing list [email protected] http://mail.gnu.org/mailman/listinfo/bug-gnu-radius
GNU Radius Remote Denial of Service Vulnerability.txt
(text/plain, 3.1 KB)
Remote Root Exploitation of Default Solaris sadmind Setting
iDEFENSE Security Advisory 09.16.03:
I. BACKGROUND
Radius is a server for remote user authentication and accounting. More information about Radius is available at http://www.gnu.org/software/radius/radius.html.
II. DESCRIPTION
Remote exploitation of a denial of service condition within GNU Radius can allow an attacker to crash the service. The problem specifically exists within the rad_print_request() routine defined in lib/logger.c. A snippet of this is shown here:
...
[0] stat_pair = avl_find(req->request, DA_ACCT_STATUS_TYPE);
if (stat_pair) {
[1] VALUE_PAIR *sid_pair = avl_find(req->request,
DA_ACCT_SESSION_ID);
[2] DICT_VALUE *dval = value_lookup(stat_pair->avp_lvalue,
"Acct-Status-Type");
char nbuf[64], *stat;
[3] if (dval)
stat = dval->name;
else {
[4] snprintf(nbuf, sizeof nbuf, "%ld", sid_pair->avp_lvalue);
stat = sbuf;
...
The denial of service condition is triggered upon the receipt of a single UDP packet that contains the attribute Acct-Status-Type. On line [0] within rad_print_request() the Acct-Status-Type attribute is accessed. On line [1] the Acct-Session-Id attribute is accessed. On line [2] the local pointer dval is set to point to the Acct-Status-Type attribute value. Because no value was specified for this attribute, dval is equal to NULL. The if-clause on line [3] fails causing line [4] to be executed. At this point due to the fact that there is no Acct-Session-Id attribute, sid_par is equal to NULL. This thereby makes the reference illegal and causes the application to crash.
The following sample output demonstrates the crash of radiusd upon receipt of the specially crafted packet:
[root@vmlinux radiusd]# gdb radiusd `pidof radiusd`
GNU gdb Red Hat Linux (5.1.90CVS-5)
Copyright 2002 Free Software Foundation, Inc.
...
[removed for sake of brevity]
...
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
rad_print_request (req=0x8085790, outbuf=0xbffff510 "húÿ¿", size=1031) at logger.c:102
102 snprintf(nbuf, sizeof nbuf, "%ld", sid_pair->avp_lvalue);
III. ANALYSIS
Successful exploitation allows unauthenticated remote attackers to cause the radius daemon (radiusd) to crash. This thereby prevents legitimate users from accessing systems reliant upon the affected radius server for authentication.
iDEFENSE has proof of concept exploit code demonstrating the impact of this vulnerability.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in the GNU Radius version 1.1.
V. RECOVERY
The Radius daemon (radiusd) must be restarted in order to resume normal operation.
VI. VENDOR FIX
The latest version of GNU Radius, version 1.2, removes the vulnerable function.
VII. VENDOR RESPONSE
TBD
VIII. CVE INFORMATION
TBD
IX. DISCLOSURE TIMELINE
September 9, 2003 Exploit acquired by iDEFENSE
January 29, 2003 Initial notification sent to Sergey Poznyakoff ([email protected])
January 29, 2003 iDEFENSE clients notified